How many CVEs does Concrete CMS have?

Concrete CMS has 163 published CVE records since 2014, including 57 in the last two years.

How many Concrete CMS CVEs are in CISA KEV?

None of Concrete CMS's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which Concrete CMS products have the most CVEs?

The Concrete CMS products with the most published CVEs are Concrete CMS, concretecms, concrete5-legacy, bedrock.

What are the most common weakness types in Concrete CMS CVEs?

Concrete CMS's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-20 (Improper Input Validation), CWE-639 (Authorization Bypass Through User-Controlled Key).

How many critical Concrete CMS vulnerabilities are there?

Concrete CMS has 7 critical and 30 high-severity CVEs.

What is the average severity of Concrete CMS CVEs?

The average CVSS base score across Concrete CMS's scored CVEs is 5.6.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

163 CVEs

Concrete CMS Vulnerabilities

Name: Concrete CMS vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Concrete CMS.

163

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

11

Public exploits

PoC or exploit code

5.6

Avg CVSS

2014–2026

Overview

Concrete CMS has 163 published CVE records since 2014, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 11 have a known public exploit. The average CVSS base score across scored CVEs is 5.6.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Concrete CMS products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Concrete CMS's vulnerability posture, as a share of its 163 published CVEs.

Average CVSS: 5.6
Critical / high: 23%
Actively exploited (KEV): 0%
Public exploit available: 7%
Patch available: 80%

Severity and exploitation

How the CVSS severity of Concrete CMS's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical7

High30

Medium102

Low24

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Concrete CMS's CVEs are currently listed in CISA's KEV catalog.

Public exploits

11

11 of Concrete CMS's CVEs have a known public exploit available.

Most affected products

The Concrete CMS products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Concrete CMS CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Concrete CMS CVE records.

Disclosure activity by year

How many Concrete CMS CVEs were published each year.

2019

1

2020

4

2021

30

2022

19

2023

24

2024

17

2025

4

2026

53

Latest Concrete CMS CVEs

The most recently disclosed vulnerabilities affecting Concrete CMS.

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components
CWE-502
High · CVSS 8.4
EPSS 0.1%2026-06-10
Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction.
CWE-502
High · CVSS 8.4
EPSS 0.2%2026-06-03
Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in atomik theme
CWE-79
Low · CVSS 2.1
EPSS 0.1%2026-05-22
Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog
CWE-639
Low · CVSS 2.3
EPSS 0.2%2026-05-22
Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion
CWE-352
Low · CVSS 2.3
EPSS 0.1%2026-05-22
Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName
CWE-79
Low · CVSS 2.0
EPSS 0.1%2026-05-21
Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block
CWE-918
Low · CVSS 2.1
EPSS 0.2%2026-05-21
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete
CWE-352
Low · CVSS 2.3
EPSS 0.1%2026-05-21
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete
CWE-352
Low · CVSS 2.3
EPSS 0.1%2026-05-21
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete
CWE-352
Low · CVSS 2.3
EPSS 0.1%2026-05-21
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache
CWE-352
Low · CVSS 2.3
EPSS 0.1%2026-05-21
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design
CWE-352
Low · CVSS 2.3
EPSS 0.1%2026-05-21

Track new Concrete CMS CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Concrete CMS CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

openatom166 CVEs phpBB165 CVEs pimcore165 CVEs djangoproject164 CVEs Rapid7162 CVEs CA Technologies162 CVEs OpenWrt162 CVEs cms_made_simple160 CVEs

Browse all vendors

Frequently asked questions

Common questions about Concrete CMS vulnerabilities.

How many CVEs does Concrete CMS have?: Concrete CMS has 163 published CVE records since 2014, including 57 in the last two years.
How many Concrete CMS CVEs are in CISA KEV?: None of Concrete CMS's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which Concrete CMS products have the most CVEs?: The Concrete CMS products with the most published CVEs are Concrete CMS, concretecms, concrete5-legacy, bedrock.
What are the most common weakness types in Concrete CMS CVEs?: Concrete CMS's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-20 (Improper Input Validation), CWE-639 (Authorization Bypass Through User-Controlled Key).
Are there public exploits for Concrete CMS vulnerabilities?: Yes — 11 of Concrete CMS's CVEs have a known public exploit.
How many critical Concrete CMS vulnerabilities are there?: Concrete CMS has 7 critical and 30 high-severity CVEs.
What is the average severity of Concrete CMS CVEs?: The average CVSS base score across Concrete CMS's scored CVEs is 5.6.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Concrete CMS vulnerabilities

Monitor new Concrete CMS vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing